Files
hermes-agent/hermes_cli
Andrex Ibiza, MBA 82a702bf67 feat(update): bake authoritative image provenance into the Docker image
Cherry-picked core of #92545: the image build writes a versioned,
non-secret marker (/etc/hermes/image-provenance.json) outside both the
bind-mountable checkout and the HERMES_HOME volume, and
hermes_cli/image_provenance.py reads it fail-closed — absence means
'not image-managed', any present-but-malformed marker still means
image-managed (an integrity defect is never permission to mutate the
image in place).

(#91277 Phase 3; salvaged from #92545 by @andrexibiza — marker bake +
reader only, the scoped carve-out.)
2026-08-26 11:41:04 -07:00
..
2026-08-21 05:16:27 -07:00
…